While testing file uploads, I noticed that JCE File Browser reports a standard JPEG image as containing embedded PHP code and blocks the upload.
After examining the file, I found no indication of executable code, malware, or any suspicious payload. The file appears to be a normal JPEG image containing standard image data and metadata only.
My understanding is that the detection may be triggered by a sequence of bytes occurring naturally within the compressed binary image data. Since image files contain arbitrary binary content, certain byte combinations can coincidentally resemble patterns that are typically associated with source code, even though they are not part of any executable content.
This suggests that the current detection mechanism may be generating a false positive by matching patterns within binary image data without verifying whether the match occurs in a valid textual or executable context.
Could you please review the detection logic to determine whether binary image content is being scanned in a way that may lead to false positives?
Thank you for your time and assistance.
